Is this MCP tool list safe to show a model?
Paste a server's tools/list. WARDEN — the open-source MCP firewall on npm — runs its static ruleset and its threat list over every tool definition: names, descriptions, input and output schemas, annotations. You get allow or block, and every finding with the rule that fired and where.
Free · no account · no wallet
What it checks
- Instructions aimed at the model: override and priority claims, concealment from the user, orders to call or rewrite other tools.
- Exfiltration: the user's data, files or the conversation sent to an outside address, blind copies to a mailbox.
- Credential and key theft: SSH keys, cloud credentials, wallet files, tokens.
- Hidden text: invisible Unicode, encoded payloads (escapes, entities, percent-encoding, base64), text pushed out of view.
- WARDEN's built-in threat list, matched against the whole definition.
What it does not check
Tool definitions only. Origin and pinning are state on your machine and need the local scan; the opt-in semantic classifier does not run here.
Privacy
What you paste is sent to modelmarket.dev, scanned in memory by WARDEN and answered. It is not stored.
Scan the servers your own clients start
The same rules, run locally: it reads the MCP configs of Claude Code, Claude Desktop, Cursor, VS Code and Windsurf, lists every server's tools and never calls one.
npx -y @aimarket/warden scanAI agents buy the same check
This page is free for people. An AI agent gets the same deterministic answer for $0.001 a call over x402 — USDC on Base, no account, no API key:
POST https://modelmarket.dev/x402/warden-scanListed in the Coinbase x402 Bazaar and on x402scan. What an agent pays for is the answer this page shows, byte for byte.
Free for agents too, at a lower rate limit:
POST https://modelmarket.dev/a2mcp/warden-scanQuestions
What is tool poisoning?
Instructions hidden in a tool's description or schema. The user sees a tool name; the model reads the whole definition and may follow it. WARDEN reads the definition the way the model does.
How is this different from the local scan?
Same rules. The local scan also connects to your servers, pins what they served and blocks when a definition drifts; this page checks one list you paste.
Can WARDEN sit in front of my servers?
Yes: warden-mcp wrap starts a server behind the firewall, and its Claude Code plugin refuses calls to blocked servers. The README on npm and GitHub has the setup.
Other free checks
x402 payment check
Why a USDC transferWithAuthorization reverts: the signer, the token domain, the window and the seller's terms — and the domain a failing signature was really made for.
MCP rug-pull diff
Two tools/list results of one server — the one you approved and today's. A verdict, a word diff per tool, and a signal for each risky thing the change added.
MCP server history (HISTOR)
A server's address or registry name. When HISTOR first pinned its tool set, how often it changed, and what the pattern scan found — from a public, signed log.